Re: [lamps] Paul Wouters' Yes on draft-ietf-lamps-rfc3709bis-08: (with COMMENT)

[Russ Housley <[e-mail]>]

> On Dec 8, 2022, at 2:41 PM, Paul Wouters <paul.wouters=[e-mail]> wrote:
> 
> On Thu, Dec 8, 2022 at 10:22 AM Tim Hollebeek <[e-mail] <mailto:[e-mail]>> wrote:
> 
> > > ### usage or install of cert?
> > > ```
> > >       Further, when logotype data is not cached, activity on the network
> > >        would reveal certificate usage frequency ```
> > >
> > > Is the usage of logotypes to be expected every time the certificate is
> > > used? Or only when the certificate is "human checked" for
> > > installation? I would think when installing a VPN cert, that I would
> > > see the logotype when installing the cert, but not every time I bring
> > > up my VPN. So I think the "certificate usage frequency" is not necessarily
> > leaked as this sentence claims.
> > 
> > This is trying to provide an example of how caching can help with privacy, not
> > anything more complex.  Doe you see a better way to make that point?
> 
> What is or is not revealed depends on exactly when and how revocation is
> checked, which is use case and ecosystem dependent.  It's impossible to
> say in general what information, if any, is leaked.
> 
> I would be very tempted to just change "would" to "might", as this is really
> just a reminder to the reader to consider such considerations.
> 
> Works for me.

I have changed the word to "might" in my edit buffer.

Russ